Cyber Insurance Checklist for Australian Businesses
This cyber insurance checklist examines both the business’s exposure and the controls used to reduce it. An organisation that understands its data, systems, suppliers, access controls, backups and incident-response plan can provide clearer information to insurers and make better coverage decisions.
Cyber insurance can support response and recovery from insured events, but it does not replace cyber security, privacy compliance or business continuity planning.
Discuss your current cover and business activities through ABS’s cyber insurance service.
Speak with a business insurance broker
Discuss your operations, property, revenue, contracts, technology and existing insurance program with ABS.
Request a business insurance review
Ask ABS to compare current cover with the risks and dependencies affecting your business.
Cyber insurance checklist: data, controls and response
Before seeking cyber insurance, document the systems and data the business depends on, annual revenue, online transactions, remote access, privileged users, multifactor authentication, backups, endpoint protection, staff training, outsourced providers and previous incidents.
The Australian Cyber Security Centre provides practical controls and guides through its Small Business Cyber Security Hub.
1. Map the Business’s Cyber Exposure
- personal, financial, health or commercially sensitive information held;
- number and location of records;
- critical applications, servers, cloud services and websites;
- online sales, payment processing and electronic funds transfer;
- remote access and mobile devices;
- managed service providers and software suppliers;
- maximum tolerable downtime; and
- legal, regulatory and contractual obligations.
Identify the systems without which the business cannot invoice, serve customers, manufacture, dispatch goods or communicate. Cyber interruption can create revenue loss even where no personal data is stolen.
2. Review the Controls Insurers Commonly Ask About
Applications may ask about multifactor authentication, privileged accounts, software patching, endpoint detection, firewalls, email filtering, staff training, encryption and tested backups.
Answer accurately. A control should not be declared as fully implemented if it applies only to some users or systems. Where a weakness exists, document the improvement plan rather than providing an incorrect answer.
Backups should be separated from the main environment and tested for restoration. The ACSC recommends practical cyber hygiene and preparation; its guidance should be used alongside qualified IT and security advice.
3. Build and Test the Incident-Response Plan
Define who will make decisions, preserve evidence, contact IT support, notify the broker or insurer, obtain legal and forensic advice, communicate with customers and assess regulatory reporting.
Store the policy and emergency contacts somewhere accessible if the main network is unavailable. Cyber.gov.au’s incident-response planning guidance emphasises detection, triage, containment, recovery and post-incident review.
Check which service providers must be insurer-approved before costs are incurred.
Frequently Asked Questions About Cyber Insurance
Does cyber insurance prevent an attack?
No. It can provide specified financial and response support after an insured event. Security controls remain essential.
What can cyber insurance cover?
Depending on the wording, sections may address incident response, forensics, legal advice, notification, interruption, restoration, extortion and liability.
Will an insurer ask about multifactor authentication?
Often yes, particularly for remote access, email and privileged accounts. Requirements differ by insurer and risk.
Should previous incidents be disclosed?
Yes, when requested. Include ransomware, unauthorised access, fraudulent transfer, privacy complaints and other relevant circumstances.
Does the policy cover every outsourced provider?
Not automatically. Dependent-business and system-provider cover is defined and limited. Identify important suppliers.
Can ABS assist with the application?
Yes. ABS can help organise insurance information and compare policy terms, while qualified IT advisers address technical controls.
Prepare the Cyber Submission Before Approaching the Market
Provide ABS with the cyber proposal, current policy, revenue, systems, data, controls, suppliers and incident history. Complete information supports a more meaningful market review.
Important information: This article provides general information only and does not consider your objectives, financial situation or needs. Insurance is subject to policy terms, conditions, limits and exclusions. Legal, contractual and compulsory requirements vary. Obtain advice appropriate to your circumstances.
